Gentlemen-
I created this script for use in running Nessus from cron - I think it may
be useful to some.
It was written for use on Solaris, but should be usable with very minor
tweaking in any Unix.
Enjoy,
-- Jeff Apolis
#!/bin/ksh
##################################################################
# Scriptname: nessus-scan.ksh
# Purpose: Scan a bunch of hosts and mail the results in an attached file.
# Prerequisite: User must be able to log in to Nessus with no passphrase.
# Usage: nessus-scan.ksh [configuration file] # Conf file argument is
optional.
#
# Author: Jeff Apolis 'jeff at apolis dot org' 8/2/01
##################################################################
export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH
export PATH=/bin
# Valid report formats are one of text, html, html_graph, tex or nsr
# html_graph is not yet supported in this script.
REPORTFMT=html
# Make a sensible file extension from the report format type
EXT=$REPORTFMT ; test "$EXT" = "text" && EXT=txt :
# Target file should list one network or host per line, in the format
x.x.x.1/24 or host.target.com
# Comments in the target file are preceded by a "#"
# We will use the first command line argument as the target file if it is
specified,
# otherwise use the default shown
TARGETFILE=${1:-/root/scan/nessus-scanhosts.conf}
# Read the conf file, delete comments, place all on one line
ALLHOSTS=$( sed s/\#.*//g $TARGETFILE | xargs )
# One or more space separated email addresses to send the results
MAILTO='security.team@ee-ee-ah-ah-whammalammabingbang.com'
# set umask so our temp files are not readable by mere mortals
umask 177
# Function to tidy up if we get killed
cleanup()
{
rm -f $DESCFILE $ERRORFILE $TMPTARGETFILE
}
# trap INT or QUIT signals
trap "cleanup;exit 1" 2 3
# This underpowered box hangs when too many nessuses are running -
#if test -z "$( ps -ef | awk '/nessus / && !/awk/ {print $2}' )" ;then
# echo "nessus client already running -- exiting." >&2
# exit 1
#fi
# Function to create the body of text for the result email
mkdescfile ()
{
cat <<EOF > $DESCFILE
#################################################################
Nessus scan started: $DATE
ended: $(date)
Targets scanned are: $TARGET
Errors reported this scan are shown below:
#################################################################
$(cat $ERRORFILE)
#################################################################
EOF
}
# Here begins the good stuff
for TARGET in $ALLHOSTS ; do
# DATE will hold the start time of the scan
DATE=$(date)
# DATESTAMP is for the filename
DATESTAMP=$(date +%Y%m%d_%H%M%S)
# nessus errors go here ...
ERRORFILE=/var/tmp/nessus-error${DATESTAMP}
# we want to create a report for each network scanned, so we create a file
with one target network at a time.
TMPTARGETFILE=/var/tmp/nessus-target${DATESTAMP}
echo "$TARGET" > $TMPTARGETFILE
# for the filename -- remove the "/xx" from the target specification if it
exists
SHORTTARGET=$(echo $TARGET | sed 's,/.*,,g')
# put together a guaranteed unique, descriptive filename
RESULTFILE=/var/tmp/nessus-results.${SHORTTARGET}.${DATESTAMP}.${EXT}
# Now do the scan
/usr/local/bin/nessus -q -T $REPORTFMT localhost 3001 root $TMPTARGETFILE
$RESULTFILE 2> $ERRORFILE
# This file will hold the body text of the results email
DESCFILE=/var/tmp/nessus-desc$$
# call mkdescfile function
mkdescfile
# mpack is a program to mail a mime-encoded binary as an attachment to an
email.
# see ftp://ftp.andrew.cmu.edu/pub/mpack/
/usr/local/bin/mpack -d $DESCFILE -s "Nessus report -- $TARGET -- $DATE "
$RESULTFILE $MAILTO
# call cleanup function
cleanup
sleep 5
done
I created this script for use in running Nessus from cron - I think it may
be useful to some.
It was written for use on Solaris, but should be usable with very minor
tweaking in any Unix.
Enjoy,
-- Jeff Apolis
#!/bin/ksh
##################################################################
# Scriptname: nessus-scan.ksh
# Purpose: Scan a bunch of hosts and mail the results in an attached file.
# Prerequisite: User must be able to log in to Nessus with no passphrase.
# Usage: nessus-scan.ksh [configuration file] # Conf file argument is
optional.
#
# Author: Jeff Apolis 'jeff at apolis dot org' 8/2/01
##################################################################
export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH
export PATH=/bin
# Valid report formats are one of text, html, html_graph, tex or nsr
# html_graph is not yet supported in this script.
REPORTFMT=html
# Make a sensible file extension from the report format type
EXT=$REPORTFMT ; test "$EXT" = "text" && EXT=txt :
# Target file should list one network or host per line, in the format
x.x.x.1/24 or host.target.com
# Comments in the target file are preceded by a "#"
# We will use the first command line argument as the target file if it is
specified,
# otherwise use the default shown
TARGETFILE=${1:-/root/scan/nessus-scanhosts.conf}
# Read the conf file, delete comments, place all on one line
ALLHOSTS=$( sed s/\#.*//g $TARGETFILE | xargs )
# One or more space separated email addresses to send the results
MAILTO='security.team@ee-ee-ah-ah-whammalammabingbang.com'
# set umask so our temp files are not readable by mere mortals
umask 177
# Function to tidy up if we get killed
cleanup()
{
rm -f $DESCFILE $ERRORFILE $TMPTARGETFILE
}
# trap INT or QUIT signals
trap "cleanup;exit 1" 2 3
# This underpowered box hangs when too many nessuses are running -
#if test -z "$( ps -ef | awk '/nessus / && !/awk/ {print $2}' )" ;then
# echo "nessus client already running -- exiting." >&2
# exit 1
#fi
# Function to create the body of text for the result email
mkdescfile ()
{
cat <<EOF > $DESCFILE
#################################################################
Nessus scan started: $DATE
ended: $(date)
Targets scanned are: $TARGET
Errors reported this scan are shown below:
#################################################################
$(cat $ERRORFILE)
#################################################################
EOF
}
# Here begins the good stuff
for TARGET in $ALLHOSTS ; do
# DATE will hold the start time of the scan
DATE=$(date)
# DATESTAMP is for the filename
DATESTAMP=$(date +%Y%m%d_%H%M%S)
# nessus errors go here ...
ERRORFILE=/var/tmp/nessus-error${DATESTAMP}
# we want to create a report for each network scanned, so we create a file
with one target network at a time.
TMPTARGETFILE=/var/tmp/nessus-target${DATESTAMP}
echo "$TARGET" > $TMPTARGETFILE
# for the filename -- remove the "/xx" from the target specification if it
exists
SHORTTARGET=$(echo $TARGET | sed 's,/.*,,g')
# put together a guaranteed unique, descriptive filename
RESULTFILE=/var/tmp/nessus-results.${SHORTTARGET}.${DATESTAMP}.${EXT}
# Now do the scan
/usr/local/bin/nessus -q -T $REPORTFMT localhost 3001 root $TMPTARGETFILE
$RESULTFILE 2> $ERRORFILE
# This file will hold the body text of the results email
DESCFILE=/var/tmp/nessus-desc$$
# call mkdescfile function
mkdescfile
# mpack is a program to mail a mime-encoded binary as an attachment to an
email.
# see ftp://ftp.andrew.cmu.edu/pub/mpack/
/usr/local/bin/mpack -d $DESCFILE -s "Nessus report -- $TARGET -- $DATE "
$RESULTFILE $MAILTO
# call cleanup function
cleanup
sleep 5
done